e15faf3f8dd5721520417c91d4ae6583b0ce0b02f447d48b2ac54330a8640879

Analysis

max time kernel
122s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:09

Target

e15faf3f8dd5721520417c91d4ae6583b0ce0b02f447d48b2ac54330a8640879.dll
Size

93KB
MD5

f8607259519cd85a4a1025e4631e1767
SHA1

57c63c1bc37d29deb069d2a9243a654e4d3392bf
SHA256

e15faf3f8dd5721520417c91d4ae6583b0ce0b02f447d48b2ac54330a8640879
SHA512

b37619d52eb4a4296c7a0ff7249ae045b3cab1c8e2b2fc18a6d59fd35bd23f8fd908976bc9468f38bb6452012f6658758135c9a7f724f581b5d721cb66a044e3
SSDEEP

1536:A6YlNaTQSTlWIROq6xWl93aK3k5NdkND75SgyIZCnlR8UUwgE:x8gQElW0exOB3KID753yIZCT8UUK

Score

1^/10

Suspicious behavior: EnumeratesProcesses 26 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4964	3564	rundll32.exe	80
PID 3564 wrote to memory of 4964	3564	rundll32.exe	80
PID 3564 wrote to memory of 4964	3564	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e15faf3f8dd5721520417c91d4ae6583b0ce0b02f447d48b2ac54330a8640879.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e15faf3f8dd5721520417c91d4ae6583b0ce0b02f447d48b2ac54330a8640879.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964